docs(changelog): inventory all releases through v1.6.0

[danielmeppiel]

TL;DR

Backfills the historical CHANGELOG (which only had an Unreleased section since being introduced in #31) with one entry per shipped release from v1.0.0 through v1.5.1, and graduates the Unreleased section to [1.6.0] - 2026-05-02. Once merged, tagging v1.6.0 triggers the existing release pipeline (CI watches tags: ['v*'] and updates the floating v1 tag).

This is a docs-only PR. No code changes.

What's in 1.6.0

Everything from PR #31 (already merged on main):

• setup-only: true mode (closes Support CLI-only mode #24) -- install APM CLI onto PATH and exit, like actions/setup-node.
• bundle-format input -- defaults to apm so existing pack/restore round-trips keep working when the upstream apm pack CLI default flips to plugin in apm 0.12. Opt into bundle-format: plugin to publish Claude Code marketplace bundles.
• New outputs: apm-version, apm-path, bundle-format.
• Plugin-bundle detection in restore paths (rejects with an actionable error pointing at the upstream tracking issue).
• Installer respects explicit apm-version (always installs into tool cache when pinned, instead of short-circuiting to whatever's already on PATH).

How the inventory was built

# 1. Per-tag commit walk
for pair in "v1.0.0:" "v1.0.0:v1.1.0" ... "v1.5.1:HEAD"; do
  git log --no-merges --format="  %h %s" $range_start..$range_end
done

# 2. PR list cross-reference
gh pr list -R microsoft/apm-action --state merged --limit 100 \
  --json number,title,mergedAt --jq '.[] | "\(.mergedAt | split("T")[0]) #\(.number) \(.title)"'

# 3. Existing release notes (v1.4.2, v1.5.0, v1.5.1) used as ground truth for wording where present
gh release view v1.5.1 -R microsoft/apm-action --json body

PRs by release window:

Release	Merged PRs
1.6.0	#31 (closes #24)
1.5.1	#23
1.5.0	#30
1.4.2	#17, #20, #22, #27
1.4.1	#21
1.4.0	#19
1.3.4	#16
1.3.3	#15
1.3.2	#14
1.3.1	#11
1.3.0	#10
1.2.0	#7, #8, #9
1.1.0	#6
1.0.0	#2, #4, #5

Validation

• wc -l CHANGELOG.md -> 192 lines, well within the section rubric ceilings.
• All [#NN] reference-style links resolve to valid PR/issue URLs.
• Every release header has a matching [X.Y.Z]: ...compare/... link at the bottom.
• Commit dates of each tag verified: e.g. v1.5.1 -> 2026-04-28, v1.4.2 -> 2026-04-24.

Next steps after merge

1. Merge this PR.
2. git tag v1.6.0 <merge-sha> && git push origin v1.6.0 -- the release job in ci.yml (triggered on refs/tags/v*) will publish the release and update the floating v1 tag to v1.6.0.
3. Smoke-test a known apm-action consumer workflow against microsoft/apm-action@v1 to confirm the floating tag moved.
4. Once the upstream apm 0.12 release is cut (carrying apm install <local-bundle>), open a follow-up issue here to migrate restore from apm unpack to apm install <bundle-path> -- that would unlock plugin-format restore (currently rejected) and let bundle-format default flip to plugin in a future major.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

This docs-only PR backfills CHANGELOG.md with historical release entries from v1.0.0 through v1.5.1 and promotes the previous Unreleased notes into a dated 1.6.0 release entry, aligning the changelog with the repository’s release/tagging workflow.

Changes:

• Adds one changelog section per shipped release from 1.0.0 to 1.5.1.
• Records the 1.6.0 release notes for the recently merged feature work from PR #31.
• Adds compare/reference links and introductory release-policy context for SemVer and the floating v1 tag.

Show a summary per file

File	Description
CHANGELOG.md	Expands the changelog into a full release history and updates release/reference links for 1.6.0.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (4)

CHANGELOG.md:53

• This overstates what #27 fixed. Restore mode still writes deployed primitive files into the workspace, so callers can end up with new/untracked files; the actual fix was that bundle metadata like apm.lock.yaml and apm.yml no longer leak into working-directory. Documenting it as leaving 'no untracked files behind' is inaccurate and could mislead users debugging git status changes.

- **`restore` mode no longer dirties the workspace** ([#27]). The action now installs the APM CLI and shells out to `apm unpack` instead of doing its own extraction inside the runner workspace, so the restore step leaves no untracked files behind. Fixes intermittent CI failures when downstream steps inspect `git status`.

CHANGELOG.md:92

• audit-report does not upload anything to Code Scanning by itself. The action only generates the SARIF file and sets audit-report-path; callers still need a separate github/codeql-action/upload-sarif step, and the markdown output goes to $GITHUB_STEP_SUMMARY, not the job log. This changelog entry currently describes behavior the action does not perform.

- **`audit-report` input for SARIF audit report generation** ([#14]). Opt-in flag that runs `apm audit` and uploads a SARIF report to the GitHub code-scanning UI, plus a markdown summary in the job log. Lets security teams surface APM dependency findings alongside the rest of their static-analysis signals.

CHANGELOG.md:109

• This section uses two names that don't match the public API shipped in #10: the release itself renamed the install path to 'non-isolated mode', and the restore input is bundle, while bundle-path is a pack output. Keeping the old terms here makes the historical changelog point readers at an input that doesn't exist.

- **Mode-aware directory creation** ([#10]). Pack and restore modes create their working directories on demand with mode-appropriate guards; default mode fails fast when the working directory does not exist.
- **Allow absolute bundle paths in restore mode** ([#10]). `bundle-path:` accepts absolute paths, not only paths relative to `working-directory`.

CHANGELOG.md:47

• This release note describes bundles-file as a YAML manifest with per-entry targets and says it complements single-bundle bundle-path: mode, but the current API is different in both places: bundles-file is a plain UTF-8 text file with one .tar.gz path per line, and single-bundle restore uses the bundle input while bundle-path is only a pack-mode output. As written, the changelog points readers at a config format and input name the action does not accept.

- **Multi-bundle restore via `bundles-file:` input** ([#30]). Restore multiple APM-format bundles in a single step by providing a YAML manifest listing each bundle path and target. Complements the existing single-bundle `bundle-path:` mode for monorepos and matrix workflows that materialize several plugins at once.

• Files reviewed: 1/1 changed files
• Comments generated: 1